Modern jet engines are extremely reliable, and in-service failures are rare. This reliability is the basis of the extended range twin-engine operations (ETOPS) approval. When two engines on the same aircraft fail for the same mechanical reasons in such a short time, this reliability is brought into question. In this case, both engine failures were the result of stress corrosion cracking of the second-stage turbine blades, a failure mode that Pratt Whitney has been actively trying to control through the use of sacrificial corrosion protection coatings. The focus of this investigation analysis was to identify the underlying causes of these two engine failures. These two engines were manufactured at approximately the same time. Neither had a corrosion protection coating on the second-stage turbine blades. The engines were installed and operated on the same aircraft, exposed to the same environment under the same operating conditions, and maintained with the same procedures. Therefore, it is expected that internal engine condition and wear patterns would be similar. In fact, both engines exhibited similar corrosion damage to the second-stage turbine blades when they were dismantled for overhaul. This damage indicates that the corrosion mechanisms were in place and operating at similar rates in each engine before the overhauls. The rate of corrosion in both engines increased dramatically after their overhauls, in spite of both engines having corrosion protective coatings applied to the second-stage turbine blades. The service life of the second-stage turbine blades of engineP733336 with the PWA545coating was expected to be considerably longer than the original, uncoated blades that had been removed from service after approximately 4000cycles; however, the coated blades failed at only 1306 cycles. The second-stage turbine blades of engineP733335, with the more advanced corrosion protection coating on new blades, were expected to last twice as long as the blades of engineP733336, but these blades failed at only 1020cycles. The corrosive environment in the under-platform cavity results from the leakage of hot gas path air past the rim seal, carrying dirt (dolomite) and sulphur, which is deposited on the surface of the blade root under the platform. The calcium and sulphur then mix in a hot environment and form anhydrite. The anhydrite attacks the surface of the turbine blade and forms pits, which are the stress concentration points that become the crack initiation sites. The cracks develop by fatigue until they reach the point of failure. Neither the corrosion nor the cracks are detectable without dismantling the engine. This situation was developing in both engines before they went in for overhaul, an indication that the rear side plate seals were no longer fully effective. That the corrosion became worse after the overhauls indicates the repair work on the seals did not restore them to their original effectiveness. The difference between the two engines was the more pronounced leaking of the rear side plate seal of engine P733335, which allowed greater airflow thus more dirt contamination into the under-platform cavity, thereby increasing the rate of corrosion attack.Analysis Modern jet engines are extremely reliable, and in-service failures are rare. This reliability is the basis of the extended range twin-engine operations (ETOPS) approval. When two engines on the same aircraft fail for the same mechanical reasons in such a short time, this reliability is brought into question. In this case, both engine failures were the result of stress corrosion cracking of the second-stage turbine blades, a failure mode that Pratt Whitney has been actively trying to control through the use of sacrificial corrosion protection coatings. The focus of this investigation analysis was to identify the underlying causes of these two engine failures. These two engines were manufactured at approximately the same time. Neither had a corrosion protection coating on the second-stage turbine blades. The engines were installed and operated on the same aircraft, exposed to the same environment under the same operating conditions, and maintained with the same procedures. Therefore, it is expected that internal engine condition and wear patterns would be similar. In fact, both engines exhibited similar corrosion damage to the second-stage turbine blades when they were dismantled for overhaul. This damage indicates that the corrosion mechanisms were in place and operating at similar rates in each engine before the overhauls. The rate of corrosion in both engines increased dramatically after their overhauls, in spite of both engines having corrosion protective coatings applied to the second-stage turbine blades. The service life of the second-stage turbine blades of engineP733336 with the PWA545coating was expected to be considerably longer than the original, uncoated blades that had been removed from service after approximately 4000cycles; however, the coated blades failed at only 1306 cycles. The second-stage turbine blades of engineP733335, with the more advanced corrosion protection coating on new blades, were expected to last twice as long as the blades of engineP733336, but these blades failed at only 1020cycles. The corrosive environment in the under-platform cavity results from the leakage of hot gas path air past the rim seal, carrying dirt (dolomite) and sulphur, which is deposited on the surface of the blade root under the platform. The calcium and sulphur then mix in a hot environment and form anhydrite. The anhydrite attacks the surface of the turbine blade and forms pits, which are the stress concentration points that become the crack initiation sites. The cracks develop by fatigue until they reach the point of failure. Neither the corrosion nor the cracks are detectable without dismantling the engine. This situation was developing in both engines before they went in for overhaul, an indication that the rear side plate seals were no longer fully effective. That the corrosion became worse after the overhauls indicates the repair work on the seals did not restore them to their original effectiveness. The difference between the two engines was the more pronounced leaking of the rear side plate seal of engine P733335, which allowed greater airflow thus more dirt contamination into the under-platform cavity, thereby increasing the rate of corrosion attack. Both engine failures resulted from stress corrosion fractures of second-stage turbine blades. The corrosion was due to the reaction of the coated PWA1484 alloy of the second-stage turbine blades to the anhydrite that had formed on its surface. The resultant corrosion pits were the initiation sites of the fatigue cracks, which progressed to the point of failure. Neither engine had a good fit between the rear side plate seal and the aft face of the second-stage turbine blades. The subsequent air leaks resulted in an increased rate of corrosion attack in both engines. The increased corrosion protection provided by the coatings did not offset the increased rate of corrosion attack resulting from the leaking air seals.Findings as to Causes and Contributing Factors Both engine failures resulted from stress corrosion fractures of second-stage turbine blades. The corrosion was due to the reaction of the coated PWA1484 alloy of the second-stage turbine blades to the anhydrite that had formed on its surface. The resultant corrosion pits were the initiation sites of the fatigue cracks, which progressed to the point of failure. Neither engine had a good fit between the rear side plate seal and the aft face of the second-stage turbine blades. The subsequent air leaks resulted in an increased rate of corrosion attack in both engines. The increased corrosion protection provided by the coatings did not offset the increased rate of corrosion attack resulting from the leaking air seals. The flight management, guidance, and envelope computer (FMGEC) software did not recognize that the engine had been shut down and therefore did not authorize auto thrust for the remaining engine.Other Findings The flight management, guidance, and envelope computer (FMGEC) software did not recognize that the engine had been shut down and therefore did not authorize auto thrust for the remaining engine. Safety Action Action Taken by the Operator In response to these engine failures, the Skyservice Flight Operations Training Department amended the training program, in areas specifically dealing with the recognition of turbine engine malfunctions, extended range twin-engine operations (ETOPS) diversion procedures, and in-flight communications. The engine failure/malfunction training includes a video presentation, handout and classroom discussion developed specifically to enhance the pilot's engine failure/malfunction recognition and response. The video discusses several engine failure scenarios, such as compressor surge/stall, engine fire, bird ingestion, engine seizure and slow engine decay. The handout covers basic turbine engine operation, accessory systems, cockpit engine instrumentation and potential engine failure causes and response techniques. These procedures and techniques are expanded upon during initial and recurrent simulator training. Simulator training sessions include multiple engine malfunctions and failures in different phases of flight to reinforce these techniques. The engine failure and diversion procedures specific to ETOPS are taught during initial and recurrent ground training. This training focuses on ETOPS diversion decision-making, ETOPS alternate criteria, and aircraft malfunctions requiring mandatory diversion. Also discussed are emergency communications requirements and practical diversion strategies. The Skyservice Flight Operations Manual and Quick Reference Handbook provide specific direction on malfunction handling to flight crews conducting ETOPS. Flight dispatchers receive comprehensive training regarding dispatching and flight following of ETOPS flights. This training includes flight planning and flight following requirements that are specific to ETOPS. It also deals with communications issues in remote/overwater areas. Updated procedures and manuals have been written and approved and all dispatchers have completed training on these new procedures. Action Taken by the Aircraft Manufacturer Airbus is developing improved FMGEC software logic which will address the issue of auto thrust following an engine shutdown using the engine fire push button. This new software is expected to be certified for use before the endof2003. Action taken by the Engine Manufacturer Pratt and Whitney has issued Alert Service Bulletins ASB72-1686 and ASB72-133 to provide on-wing and off-wing inspection procedures for all PW4000-94inch and -100inch HPT second-stage blades. The information from these inspections has been used to customize the Operator Fleet Management Plans to manage the HPT blade stress corrosion issue. Changes to the rear side plate repair procedure will be addressed in2003.